Trust center
Security, privacy and AI governance
Where your data lives, who can read it, what the AI may and may not do, and what we do not have yet. One link for your security review.
Reviewed , verified against the shipped platform
Stored in Canada
Montréal region, with backups in the same region.
Isolated in the database
Row-level security on every organisation’s tables.
A person decides
AI proposes. No AI can move a record’s workflow stage.
SOC 2 Type I
In preparation. No certification is claimed today.
The answers
What a security review asks
27 answers
Isolation
How is one customer’s data kept from another’s?
Five layers: a permission check on every request, an organisation filter in every query, a per-organisation context for background work, deny-by-default policies, and row-level security in the database itself, forced on under a role that cannot bypass it.
What happens if a query forgets the organisation filter?
The database returns no rows. Row-level security is forced on every organisation’s tables, so a missing filter fails closed.
Does anything read across organisations?
A few named platform jobs do, such as the opt-in benchmark, which builds anonymised figures from at least five operators. They run under a separate role and never show one operator’s records to another.
Data and backups
Where is our data stored?
In Canada, in the Montréal region of our database provider. Files and backups stay in the same region.
Where is it processed?
The application runs in the United States, in the US East region. AI requests go to OpenRouter. Every sub-processor is named in the register, with its role and region.
Is it encrypted?
AES-256 at rest on the database, files and backups, as attested by our providers. HTTPS everywhere, with strict transport security; TLS 1.0 and 1.1 are refused.
How is it backed up?
Seven rolling daily backups, in the same region. Point-in-time recovery is not enabled today, so up to a day of changes could be lost in a full restore.
Can we take everything out?
Yes, at any time: every record and the audit log, as JSON or CSV, delivered as a signed download link that lasts seven days. Occurrences also export as E5X for ECCAIRS.
AI
Can the AI change a safety record?
Inside eAviora, eAvy proposes and a person accepts, edits or rejects before anything is written. One exception, started by you: a bulk import can apply high-confidence classifications, marked unvalidated, and sends the rest and a sample to a person. An outside assistant you connect over MCP acts with that person’s own role, and its writes are audited. No AI can move a record’s workflow stage.
What does the AI receive?
Only the record fields an agent is set up to read. A confidential or anonymous reporter is never part of it.
Is our data used to train models?
eAviora trains no model on your data. AI requests are processed through OpenRouter; ask us how the model providers behind it handle requests, and we will show you the current setting.
How is AI use metered?
In credits, from one shared monthly pool per organisation, with hard caps you set.
Confidential reporting
Can a reporter stay confidential?
Yes. A confidential report carries no reporter identity on the record, and audit, timeline and export views hide the reporter from anyone below the clearance level. Anonymous reports are hidden from everyone, our own staff included.
Who can see a sensitive record?
Each record carries one of five confidentiality levels: open to the organization, module members only, named people only, confidential or privileged. Without clearance it does not appear in lists or notifications, and the assistant does not show its content.
Are safety bulletins de-identified?
Tail numbers and dates are removed automatically, the draft is written without names, and a person approves the bulletin before it is shared.
Sign-in and access
Do you support single sign-on?
Yes: SAML 2.0 with Okta, Microsoft Entra or Google, accounts created at first sign-in, and single sign-on enforced for your organisation if you choose.
Can accounts be provisioned automatically?
Yes, through SCIM 2.0, so a leaver loses access without a manual step.
What about multi-factor sign-in?
Authenticator codes for every user, with a fresh check before sensitive actions. Passkeys are available as an experimental option.
Can a user see and end their sessions?
Yes: active sessions, the last 20 sign-ins, and sign out everywhere in one step.
How are API keys controlled?
Each key has a read, write or admin scope, is stored hashed, is shown once when created, and records when it was last used.
Audit trail
Is every change logged?
Every change made in the app or through the API writes its audit entry in the same transaction as the change. Sign-in and provisioning events are logged too, outside that transaction.
Can the log be altered?
Updates are refused by the database itself, and so are deletes, outside one gated maintenance path. Entries are chained, so a gap shows.
Can our auditors use it?
Yes: search by record, person, date and action in the app, and export it as JSON or CSV.
Not yet, stated plainly
Are you SOC 2 certified?
SOC 2 Type I is in preparation. No certification is claimed today. Type II follows the required observation period.
Has a penetration test been done?
Not yet. No third-party penetration test has been performed, so there is no report to share.
Do you hold ISO 27001?
No. Our hosting providers hold their own certifications; eAviora does not.
Can we bring our own encryption keys?
Not today. Keys are managed by our database provider.
Found a vulnerability?
Tell us privately
Write to security@eaviora.com. We acknowledge every report within 24 hours.
security@eaviora.comWalk your security team through it
Bring your questionnaire. We answer it live, on the running platform.